PIV Systems – Threat Environment

You are here: Technology Topics » Computer & Gadgets » Computer & Network Security » PIV Cards » PIV Systems – Threat Environment

The Personal Identity Verification System is defined to enhance security and trust in identity credentials, but no practical system can guarantee perfect security.  In this post we  discusses known technical threats to Personal Identity Verification authentication mechanisms, especially the Cardholder Unique Identifier (CHUID) authentication mechanism.

Methods of attack are described in general terms, and this is not an exhaustive list of possible attacks. Attackers often succeed by exploiting overlooked or newly introduced vulnerabilities in operational systems.

The Personal Identity Verification System protects the trustworthiness of the Personal Identity Verification Card data objects through Personal Identity Verification Card access rules and digital signatures. Overall trust in the execution of a Personal Identity Verification authentication mechanism is also dependent on correct operation of the Personal Identity Verification Card, the Physical Access Control Systems, and the Personal Identity Verification Card validation infrastructure, and, to a degree, on protecting the confidentiality, integrity, and availability of the communication channels among them.

Attacks may, therefore, be directed against any of these components, with varying difficulty and potential impact.
The factors critical to sustained trust in the Personal Identity Verification System are:

• The strength of cryptographic operations
• The protection of private and secret keys by system components
• The successful decryption and/or signature verification of data objects at expected times
• The continuous implementation of access rules by the Personal Identity Verification Card
• The trusted operation of other system elements in the Personal Identity Verification System and the Physical Access Control Systems.

To execute a Personal Identity Verification authentication mechanism, the Personal Identity Verification cardholder presents his or her card to the Physical Access Control Systems. The presentation of the Personal Identity Verification Card occurs outside the security perimeter to which access is requested. When the presentation occurs at the outermost perimeter of a facility, the cardholder is in an Unrestricted area, and various technical attacks are easily carried out.

Special security precautions must be taken to ensure protection of these devices at the outermost perimeters of the facility. Even at interior perimeters, the degree of protection provided by enclosing perimeters may be modest when the means of attack can be easily concealed.

Possible attack vectors include identifier collisions, terminated Personal Identity Verification Cards, visual counterfeiting, skimming, sniffing, social engineering, electronic cloning, and electronic counterfeiting. These methods of attack, as well as others, are discussed below.



No Responses to “PIV Systems – Threat Environment”

1. omar says:

   Very interesting article.I wait to read more about this subject
2. Ken says:

   interesting post
3. P. Silva says:

   a very good article about PIV Systems – Threat Environment